A better way to define and insure systemic cyber events

The cyber insurance market lacks a clear definition of what constitutes “systemic risk.” At Chubb, we define a “systemic” event in the cyber context as one that could inflict widespread harm to many customers due to shared elements or commonalities – often a single point of failure that is exploited. Put simply, it’s a cyber incident that impacts multiple entities in a single act. One example of a systemic event is the exploitation of a vulnerability in a file transfer software utilized by thousands of businesses to deploy malware, exfiltrate data, or cause disruption in business. With so many clients exposed to loss by that single exploit, aggregate losses can be catastrophic.

At Chubb, we recognized three problems with respect to how the industry was addressing systemic cyber risk: 1) lack of coverage clarity for the insured, 2) inadequate pricing of the risk, and 3) insufficient focus on tracking and monitoring exposure.

To address the first, we employed a clear definition of what constitutes a widespread cyber event. It clarifies that a systemic event is one that occurs via a single act and reinforces the broad potential impact of a single act that is unique to cyber risk. When policy wording is clear and certain, costly litigation can be mitigated and insurers can offer more capacity and consistency.

Second, we designed our policy so that the insured could see the pricing for systemic coverages transparently and make an active decision on what limits and retention to purchase in accordance with their risk tolerance. This is a familiar concept for insurance products, such as the provision of earthquake coverage separately from all other perils coverage in a property policy.

Third, we worked with modeling firms to align the event scenarios with the policy definitions to encourage a more consistent and laser focus on this exposure.

Reinsurance remains substantially a quota share market today, as it has been for many years. On the surface, that means insurers cede a share of the premium and an equal share of the losses to reinsurers. However, most contracts include a cap on reinsurers’ losses, which leaves significant tail exposure with the cedant without the premium to pay those claims. A more efficient use of capital involves reinsurers covering cyber on an event excess of loss basis. This is similar to the model that works with catastrophe excess of loss reinsurance for property, which protects insurers from an accumulation of losses due to a single CAT event. This approach offers reinsurers greater margins for assuming tail volatility with the use of proportionately less capital. Reinsurers’ ROEs increase and the overall cyber insurance market becomes more efficient. To evolve, the reinsurance market needs a clear definition of what a systemic cyber event is and a consistent approach to modeling frequency and severity of those events. Both the Chubb policy and one promulgated by Cyber AcuView, an industry consortium of the largest cyber insurers in the world, provide that clear definition of a systemic event, and modeling firms have vastly improved the quality and consistency of their models over the past 12 months.

Chubb is one of the leading providers of cyber insurance globally. We have underwritten cyber exposures for policyholders for more than two decades. We’re focused on being a leader in order to break through any barriers. We will continue to use our underwriting experience, data, and insights to develop solutions to help meet this growing risk. We are confident our model can provide meaningful protections for our clients and serve as a model for other insurers to follow. By offering more uniform coverages and insuring agreements with potentially different limits, deductibles and pricing, significant benefits would accrue for buyers and reinsurers.